Methods and apparatuses for data protection

ABSTRACT

Methods and apparatuses for data protection against corrupted write operations. In one embodiment, a technique of crash protection uses an atomically updated global transaction indicator to switch a set of data structures from one set of versions to another set. In one embodiment, the storage space for multiple versions of a data structure is allocated at the time the data structure is created on the storage device so that the multiple versions of the data structure can be kept close by. Between two consistent points, some data structures are modified to create new versions without changing the corresponding previous versions; and unmodified data structures are not copied. At a consistent point, the global transaction indicator is updated to indicate a set of consistent versions of the data structures, such as metadata of a file system.

TECHNOLOGY FIELD

At least some embodiments of the present invention relate to protectionof data on a non-volatile storage device against corrupted writeoperations which may cause data inconsistency, such as file systeminconsistency.

BACKGROUND

When a computer system crashes during updating a data structure on anon-volatile storage device (e.g., a disk), the data structure maybecome corrupted. A data structure typically contains inter-relatedportions of data. When the data structure is only partially updated(e.g., because a crash prevented the completion of an update), theinter-relation among portions of the data may become invalid, leavingthe data structure in a state of inconsistency.

For example, a file system typically contains metadata, which organizesuser data in a storage unit. A file system typically includes metadatato describe the location, the size, and other information about files inthe storage unit. A file system may also maintain metadata to identifythe free space on the storage unit which can be allocated for thestorage of additional data. If the file system metadata is in aninconsistent state, the system may crash or corrupt user data duringoperation.

An operating system is typically programmed to update and access thefile system metadata in a consistent fashion. The file system metadatamay be cached in the volatile memory of the computer system for fastaccess. To cleanly shutdown a file system, an operating system typicallyputs the metadata of the file system on a non-volatile storage device ina consistent state by completing any pending write operations andflushing the data from cache into the non-volatile storage device.

However, if a computer crashes, unexpectedly reboots or loses power, thefile system metadata on the non-volatile disk storage may suffercorruption if the metadata is only partially updated. Thus, after anunclean shutdown, an operating system typically checks the file systemmetadata for consistency to validate the file system.

On large file systems checking the file system metadata for consistencycan take a very long time. Further, the repair process may not always beable to fix all possible types of corruption. After a crash, a recoveryprocess may need user intervention to bring the file system metadatainto a consistent state.

Data consistency is also of concern to databases users. Traditionally,databases use transaction processing techniques to maintain databaseconsistency in the presence of a system crash. One transactionprocessing technique is to group one or more write operations into atransaction so that the data system is consistent before and after thetransaction. The operations for a transaction is logged but notperformed before a request to commit the transaction is received. Atransaction commit operation updates the database according to the log.The log is typically in a form such that, after a partial commitment ofthe transaction, the database system can roll back to the state beforethe transaction or replay the log to reach the state after thetransaction.

Before and after the execution of the transaction commit operation, thedatabase is in a consistent state; during the execution of thetransaction commit operation, the database is typically in aninconsistent state. If a crash happens during the execution of thetransaction commit operation, the log can be used to roll back to theconsistent before-transaction state or replayed to reach the consistentafter-transaction state.

In a journaling file system, a complete set of modifications made to theon-disk structure of the file system is organized as a transaction. In away similar to the database operations, a journaling file systemmaintains a log of the operations to perform one or more transactions.After a crash, uncompleted transactions can be replayed according to thelog to bring the system to a consistent point.

Certain copy-on-write file systems maintain multiple versions of files.For example, a Write Anywhere File Layout (WAFL) file system hasalgorithms and data structures to implement snapshots, which areread-only clones of the active file system. WAFL stores metadata infiles, including the inode file which contains the inodes for the filesystem, the block-map file (e.g., in the form of a bit map or an extentmap) which identifies free blocks, and the inode-map file whichidentifiers free inodes. An inode typically includes information of afile regarding user and group ownership, access mode (e.g., read, write,execute permissions) and type, locking information, the number of linksto the file, the size of the file, access and modification times, theaddresses of the blocks of the file, etc. WAFL keeps metadata in filesso that meta-data blocks can be written anywhere on disk.

A WAFL file system is in the form of a tree of blocks. At the root ofthe tree is the root inode that describes the inode file. The inode filecontains the inodes that describe the rest of the files in the filesystem, including the block-map and inode-map files. The leaves of thetree are the data blocks of the files.

WAFL creates a special snapshot periodically (e.g., every few seconds)to obtain a completely self-consistent image of the entire file systemand mark a consistent point. Between consistency points, WAFL write dataonly to blocks that are not in use, so the tree of blocks representingthe most recent consistency point remains completely unchanged. WAFLuses non-volatile RAM (NVRAM) (e.g., special memory with batteries thatallow it to store data even when system power is off) to keep a log ofwrite requests processed since the last consistency point. After anunclean shutdown, WAFL replays any requests in the log to prevent dataloss.

SUMMARY OF THE DESCRIPTION

Methods and apparatuses for data protection against corrupted writeoperations are described here. Some of the embodiments of the presentinvention are summarized in this section.

In one embodiment of the present invention, a technique of crashprotection uses an atomically updated global transaction indicator toswitch a set of data structures from one set of versions to another set.In one embodiment, the storage space for multiple versions of a datastructure is allocated at the time the data structure is created on thestorage device so that the multiple versions of the data structure canbe kept close by. Between two consistent points, some data structuresare modified to create new versions without changing the correspondingprevious versions; and unmodified data structures are not copied. At aconsistent point, the global transaction indicator is updated toindicate a set of consistent versions of the data structures, such asmetadata of a file system.

This metadata may include (a) a file which identifies free and/orallocated blocks on the storage medium (e.g., in the form of a bit mapor an extent (range) map; (b) data describing the structure of the filedirectories; (c) data describing each file (e.g., the addresses of theblocks of the storage medium which contain the data of the file; userand group ownership of the file; access mode, such as read, write, andexecute permissions; the size of the file; access and modificationtimes; etc.).

In one aspect, a method for data protection includes: atomicallyrecording a first global transaction identifier to indicate a firstconsistent point for a plurality of first versions of a plurality ofdata structures; creating one or more second versions of a portion ofthe plurality of data structures without destroying the plurality offirst versions of the plurality of data structures; and atomicallyrecording a second global transaction identifier to indicate a secondconsistent point for the one or more second versions of the portion ofthe plurality of data structures and a portion of the plurality of firstversions of the plurality of data structures. In one embodiment, thedata structures include metadata of a file system for at least onemachine readable storage device; and a portion of the data structurecorresponding to the portion of the plurality of first versions is notchanged between the first and second consistent points. In oneembodiment, the plurality of first versions are tagged with one or morefirst transaction identifiers to indicate that the plurality of firstversions are created no later than the first global transactionidentifier; and the one or more second versions are tagged with one ormore second transaction identifiers to indicate that the one or moresecond versions are created no earlier than the first global transactionidentifier and no later than the second global transaction identifier.

In one embodiment of the aspect, the method further includes: recordinginformation identifying the portion of the plurality of data structuresbefore creating the one or more second versions; and searching theportion of the plurality of data structures according to the informationfor invalid versions after a crash.

In another embodiment of the aspect, the method further includes:determining one or more third transaction identifiers after a crash, theone or more third transaction identifiers including the one or moresecond transaction identifiers; and recording information specifying theone or more third transaction identifiers to indicate that versionstagged with the one or more third transaction identifiers are invalid.In one example, a background process is used to search for an invalidversion that is tagged with one of the one or more third transactionidentifiers.

In another aspect, a method for data protection includes: allocating astorage space on a non-volatile storage for a plurality of copies of adata structure to create the data structure on the non-volatile storage;and storing a plurality of different versions of the data structure inthe storage space. In one example, the storage space is localized on thenon-volatile storage; and the allocating occurs before any portion ofthe storage space is needed.

In one embodiment, the plurality of versions of the data structure aretagged with a plurality of transaction identifiers respectively toindicate a time sequence of the plurality of versions. Informationindicating transactions successfully committed on the non-volatilestorage is stored (e.g., on the non-volatile storage).

In one embodiment, the information includes a first transactionidentifier indicating a set of identifiers used to tag transactionsprior to the first transaction identifier. In one embodiment, theinformation further includes one or more ranges of transactionidentifiers to represent unsuccessfully committed transactions.

In one embodiment, the data structure is a metadata of a file system onthe non-volatile storage, such as inode, block allocation map,inode-map, etc.

In one aspect of an embodiment of the present invention, a method forprocessing data, includes: maintaining a first version of portions of afile and a corresponding first transaction ID; storing a second versionof portions of the file and a corresponding second transaction ID; andstoring, through an atomic recording process, a global transaction ID tomark a consistent point in relation with the first and secondtransaction IDs. In one example, a later recorded version has atransaction ID higher than a corresponding earlier recorded version; anda version with a transaction ID closest to, but not larger than, theglobal transaction ID is a part of the consistent point. In one example,the global transaction ID marks the consistent point for a plurality offiles based on a relation between the global transaction ID andtransaction IDs of versions of portions of the plurality of files. Inone example, the file, the first and second transaction ID and theglobal transaction ID are stored in one non-volatile storage device.

In one aspect of an embodiment of the present invention, a method forprocessing data, includes: recording a plurality of versions of aplurality of data structures with transaction identifiers forcorresponding ones of the versions; and storing atomically a globaltransaction identifier to mark a consistent point based on a relationbetween the global transaction identifier and the transactionidentifiers. In one example, the global transaction identifier indicatesthat the consistent point includes versions of data with transactionidentifiers closest to but not larger than the global transactionidentifier. In one example, the plurality of versions of the pluralityof data structures are recorded on a non-volatile storage device; theglobal transaction identifier is stored atomically onto the non-volatilestorage device. In one example, at least one of the plurality of datastructures includes a plurality of different versions.

In one aspect of an embodiment of the present invention, a method forprocessing data, includes: after a crash, retrieving a globaltransaction identifier; and storing information indicating one or moretransaction identifiers as invalid according to the global transactionID. In one example, the method further includes: receiving a request toaccess a first data; and determining whether or not a version of thefirst data is invalid based one checking a transaction identifier of theversion of the first data against at least the information indicatingthe one or more transaction identifiers as invalid. In one example, theglobal transaction identifier is retrieved from a storage device where aplurality of versions of the first data are stored; and the informationindicating the one or more transaction identifiers as invalid is storedonto the storage device. In one example, the global transactionidentifier is updated before a transaction identifier is provided torecord a new version of data onto the storage device.

In one aspect of an embodiment of the present invention, a method forprocessing data, includes: after a crash, retrieving informationindicating one or more locations in a storage device; retrieving aglobal transaction ID; and searching the one or more locations in thestorage device according to the information for one or more invalidversions of data based on checking whether or not a relation between atransaction identifier of a version of data and the global transactionID is broken. In one example, the method further includes: deleting oneor more versions of data with invalid transaction identifiers. In oneexample, a transaction identifier larger than the global transaction IDis invalid. In one example, the information and the global transactionID are retrieved from the storage device; a file system records theinformation indicating locations of new versions of data into thestorage device before recording corresponding new versions; and the filesystem updates atomically the global transaction ID on the storagedevice upon completion of recording the corresponding new versions.

In one aspect of an embodiment, a non-volatile storage device, includes:a first portion storing a plurality of versions of a plurality of datastructures, each version having a transaction identifier; and a secondportion coupled with the first portion, the second portion storing aglobal transaction identifier to mark a consistent point based on arelation between the global transaction identifier and the transactionidentifiers. In one example, the device further includes: a thirdportion storing information indicating at least one location in thefirst portion where at least one version of one data structure isrecorded after the consistent point. In another example, the devicefurther includes: a third portion storing information indicating atleast one invalid transaction identifier. In one example, differentversions of each of the data structures are positioned close to eachother in the first portion.

The present invention includes methods and apparatuses which performthese methods, including data processing systems which perform thesemethods, and computer readable media which when executed on dataprocessing systems cause the systems to perform these methods.

Other features of the present invention will be apparent from theaccompanying drawings and from the detailed description which follows.

BRIEF DESCRIPTION OF THE DRAWINGS

The present invention is illustrated by way of example and notlimitation in the figures of the accompanying drawings in which likereferences indicate similar elements.

FIGS. 1-4 illustrate methods to use an atomic update of a globaltransaction identifier to mark a consistent set of versions of datastructures according to embodiments of the present invention.

FIG. 5 illustrates an example of crash recovery according to oneembodiment of the present invention.

FIG. 6 shows a method to update data structures for crash recoveryaccording to one embodiment of the present invention.

FIG. 7 shows a method to recover from a crash according to oneembodiment of the present invention.

FIG. 8 illustrates another example of crash recovery according to oneembodiment of the present invention.

FIG. 9 shows another method to update data structures for crash recoveryaccording to one embodiment of the present invention.

FIG. 10 shows another method to recover from a crash according to oneembodiment of the present invention.

FIG. 11 shows a method to perform transactions according to oneembodiment of the present invention.

FIG. 12 shows a system to perform transactions according to oneembodiment of the present invention.

FIG. 13 shows a block diagram example of a data processing system whichmay be used with the present invention.

DETAILED DESCRIPTION

The following description and drawings are illustrative of the inventionand are not to be construed as limiting the invention. Numerous specificdetails are described to provide a thorough understanding of the presentinvention. However, in certain instances, well known or conventionaldetails are not described in order to avoid obscuring the description ofthe present invention. References to one or an embodiment in the presentdisclosure are not necessarily references to the same embodiment; and,such references mean at least one.

At least one embodiment of the present invention provides a technique ofcrash protection which uses an atomically updated global transactionindicator to switch a set of data structures from one set of versions toanother set.

In one embodiment, a data structure maintains multiple versions of thedata. Data consistency is maintained through switching from oneconsistent set of versions of data structures to another set. Theswitching is realized through the atomic update of the globaltransaction indicator. For example, an atomically updated globaltransaction ID can be used to switch to a new consistent set of versionsof the data structures.

The data structure may be one or more of various different types ofdata. For example, the data structure may be the file system metadatamaintained by a computer's operating system such as (a) a data structurewhich identifies free and/or allocated storage blocks on one or morestorage media (e.g., a block allocation bit map or an extent (range) mapwhich indicates free blocks), or (b) data describing the structure ofthe file directories (e.g., directories and subdirectories which arewithin the directories and hierarchically higher subdirectories), or (c)data (e.g., file system metadata) describing each user file (such as theaddresses of the blocks of the storage medium which contain the data ofthe user file and/or user and group ownership of the user file and/oraccess mode/permissions (e.g., read or write or execute) and/or the sizeof the user file and/or the type of file and/or the name of the userfile and/or user access and creation and modification times, and/orother information contained in an inode file for a user file, etc.) Thedata structure may be, in certain embodiments, the actual user files(rather than file system metadata about those user files) or usermetadata about user files (e.g., user supplied metadata about user filessuch as title, or summary or other information). The data structure cantake a variety of different forms, including list forms or hash tableforms or tree forms.

In one embodiment, the file system allows the concurrent access frommultiple applications. The multiple applications may be runningconcurrently under the control of a multi-tasking operating system. Themultiple applications may perform concurrent write operations ondifferent files in the file system. When a file is opened for writeoperations by one application process, this file may or may not belocked for write operations with respect to other application processes.In one embodiment of the present invention, when the applications makesystem calls to perform write operations, the system automatically usestransaction ID to tag different versions of data. The file systemrecords a global transaction ID to mark (e.g., automatically andperiodically) a consistent point for consistent versions of data thathave already been flushed into the non-volatile storage. Thus, theoperations of the global transaction ID and the transaction IDs fordifferent versions of data are encapsulated from the applications.Alternatively, the file system may expose some or all of the operationsrelated to the transaction IDs for different versions and the globaltransaction ID to applications through a set of application programinterfaces (APIs).

In one embodiment of the present invention, different transaction IDsare provided to tag different versions of the data structures createdthrough write operations. A data structure can have multiple versionsassociated with multiple transaction IDs respectively. For example, abit map file of the allocation of blocks of a storage medium would have,for the same block, multiple versions of data for the same block, eachversion with its different, respective transaction ID.

In one embodiment, comparison between a transaction ID of a version ofthe data structure and the global transaction ID can be used todetermine the validity of the corresponding version of the datastructure. In one embodiment, the atomically updated global transactionID and transaction IDs for write operations between atomic updates ofthe global transaction ID are generated in a way such that whether ornot a transaction ID of a version is issued after the atomic update ofthe global transaction ID can be determined from the global transactionID and the transaction ID of the version.

For example, in one embodiment, transaction IDs for write operations,which are performed after an atomic update of the global transaction ID,are larger than the global transaction ID; and the global transaction IDis atomically updated to a number larger than previously transaction IDsused for write operations. Thus, if a version of a data structure has atransaction ID that is larger than the global transaction ID, thecorresponding version of the data structure is written (create orupdated) after the consistent point indicated by the global transactionID. If a version of a data structure has a transaction ID that issmaller than the global transaction ID, the version of the datastructure is written before the consistent point indicated by the globaltransaction ID.

The data structures including a version that is created/updated afterthe consistent point indicated by the global transaction ID may be in aninconsistent state. The set of latest versions of the data structuresthat are written before the consistent point are in a consistent state,as indicated by the global transaction ID.

In one embodiment of the present invention, to access the latestconsistent set of versions of the data structures, a system locates aversion of the data structure with the most recent valid transaction ID(e.g., smaller than and closest to the global transaction ID). Versionsof data structure which have invalid transaction IDs (e.g., larger thanthe global transaction ID after a crash) are ignored.

In one embodiment of the present invention, a data structure maintainsat least the latest version written before the consistent point when thedata structure is updated to create the next version. Thus, the set ofdata structures has at least one set of versions that represent aconsistent point. When the new updates reach a consistent point, anatomic update to the global transaction ID switches the set of datastructures to the next consistent point.

For example, after flushing any on-disk buffer, writing the globaltransaction ID block and again flushing any on-disk buffers, a newconsistent point is reached. When the data blocks of a transaction havebeen written to the disk to bring the file system to a consistent point,the global transaction ID can be updated on disk to indicate theswitching from the previous set of consistent versions to the currentset of consistent versions. A transaction is complete when the globaltransaction ID is safely updated on the non-volatile storage device(e.g., after the non-volatile storage device acknowledges that it hascompleted the flushing operation in response to the method's flushingcommand to the non-volatile storage device).

In one embodiment, the atomic update of the global transaction IDindicates a consistent set of versions of the set of data structures.Between the atomic updates of the global transaction ID, writeoperations on the non-volatile storage device can create newinconsistent versions of data structures. However, even wheninconsistent updates are made to the set of data structure, the set ofconsistent versions of the set of data structures (that were previouslystored) is preserved and is accessible according to the globaltransaction ID. Thus, the file system always has a consistent versionsecured on the disk.

In one embodiment of the present invention, the atomically updatedglobal transaction ID is used to indicate the set of valid transactionID. For example, if a transaction ID of a version of a data structure islarger than the global transaction ID after a crash, the correspondingversion of the data structure is considered invalid, since itcorresponds to an incomplete update on the non-volatile storage device(e.g., a crash occurred in the middle of a write transaction to thenon-volatile storage medium so only some of the data in that transactionwas saved).

In one embodiment of the present invention, the global transaction IDcan have a number of versions corresponding to a number of consistentpoints in time. A version of the global transaction ID marks aconsistent set of versions updated prior to the version of the globaltransaction ID. Thus, a number of previous consistent points areaccessible.

In one embodiment of the present invention, multiple versions of a datastructure are kept close by (e.g., in the same track or on adjacenttracks of a non-volatile storage medium such as a magnetic hard drive)to prevent storage fragmentation, reducing the disk seek penalty forfetching blocks of data which are not close by. In one embodiment of thepresent invention, the storage space for the multiple versions of a datastructure is allocated at the time the data structure is created on thestorage device (before any portion of the storage is needed or actuallyused and before any version of the data structure is stored on thestorage device) so that the multiple versions of the data structure canbe kept close by. In one embodiment, the transaction IDs for themultiple versions indicate the time sequence of the versions (e.g., theversion with a larger transaction ID is generated later in time than theversion with a smaller transaction ID). In one embodiment, when thepre-allocated space for multiple versions of a data structure are fullypopulated with different versions of data, the oldest version can beoverwritten to store data for the latest version.

In one embodiment of the present invention, the global transaction ID isused to globally mark the consistent point for a set of data structureshaving multiple versions maintained individually for the datastructures. Between two atomic updates of the global transactions, someof the data structures may be updated to create new versions, while theremaining of the data structures may not have a new version. Generally,the global transaction ID marks a consistent combination of versions ofthe data structures. Typically, two consistent points share the sameversions of some data structures without modification or copying andhave different versions for other data structures that are modifiedbetween the two consistent points.

If a crash occurs while a write transaction is in progress, there may bepartially updated data structures on the non-volatile storage (e.g.,disk). The partially updated versions of the data structures areinvalid. In one embodiment of the present invention, write operations,which are performed after an atomic update of the global transaction ID,create new versions that are tagged with one or more transaction IDsgreater than the global transaction ID (e.g., through copy-on-write).The latest version less than or equal to the global transaction ID ismaintained and not changed. After the crash, comparing the globaltransaction ID and transaction IDs of the new versions can determine ifthe corresponding version is invalid.

In one embodiment of the present invention, a record of the list of datastructures to be modified is secured on a non-volatile storage devicebefore modifications to the data structures are made to create newversions of the data structures. In the recovery process, the datastructures on the list are checked for invalid versions throughcomparing the transaction IDs of versions of the data structures on thelist and the global transaction ID. After the invalid versions (e.g.,the versions created after the atomic update of the global transactionID) are cleaned, the data system returns to the consistent point markedby the global transaction ID.

In one embodiment of the present invention, the recovery process isperformed on demand (or in background). When a data structure isaccessed, the versions of the data structure are checked to determinethe latest valid version. Thus, it is not necessary to eliminate theinvalid versions before using the data system.

In one embodiment, the global transaction ID is updated atomically tomark a consistent point after the recovery process is complete.

In one embodiment of the present invention, a non-volatile record of arange of invalid transaction IDs is determined in the recovery process.For example, typically, there is a maximum number of transactionsallowed between two consistent points marked by two atomic writes of theglobal transaction ID. Thus, the range of the transaction IDs determinedfrom the global transaction ID on disk and the maximum increment can berecorded as invalid transaction IDs after a crash has occurred. Therange of invalid transaction IDs covers the maximum number of in-flighttransactions. The range of invalid transaction IDs will be excluded frombeing used in subsequent transactions.

In one embodiment of the present invention, the transaction ID of aversion of an accessed data structure is validated against the range ofinvalid transaction IDs. Thus, it is not necessary to search andeliminate the invalid versions before the use of the data system after acrash.

In one embodiment of the present invention, the data for a datastructure is written only once to create a new version. In a journalingapproach, the data structure is effectively written twice, once as logand once as an update to the data structure. Further, journaling has thelimitation of contention and serialization imposed by a single journal.

In one embodiment of the present invention, multiple versions arelocated close to each other to prevent fragmentation. In a WAFLapproach, the data structure is spread around the disk, leading tosignificant fragmentation. In general, atomically updating a globaltransaction identifier to make a checkpoint is faster than making asnapshot of the WAFL file system.

FIGS. 1-4 illustrate methods to use an atomic update of a globaltransaction identifier to mark a consistent set of versions of datastructures according to embodiments of the present invention.

In FIG. 1, a non-volatile memory (101) is used to store a plurality ofdata structures. For example, a storage (105) is allocated for a datastructure when the data structure is created on the non-volatile memory(101). The storage (105) can be used to store a plurality of versions(111, 113, . . . , 119) of the data structure. The storage (105) isallocated at the time the data structure is created so that theplurality of versions (111, 113, . . . , 119) of the data structure canbe stored physically close to each other (e.g., within the same track oron adjacent tracks on the same physical recording medium).

In FIG. 1, data versions (111, 113, . . . , 119) are tagged withcorresponding transaction identifiers (121, 123, . . . , 129)respectively. Typically, when a transaction with a given transactionidentifier is made to create the data structure, a version of the datastructure tagged with the given transaction identifier is created in oneslot of the storage (105). When another transaction with a differenttransaction identifier is made to update the data structure, a newversion of the data structure tagged with the corresponding transactionidentifier is created in the storage (105) at a different slot of thestorage (105). Thus, a previous version of the data structure remainsunchanged while a new version of the data structure is created.

When the storage (105) is fully populated with different versions, a newversion can overwrite the oldest version which may be identified by itstransaction identifier. In one embodiment, at least one version closestto and earlier than the global transaction identifier (103) is notoverwritten between two atomic updates of the global transactionidentifier. Alternatively, only one new version is created between twoconsistent points.

In one embodiment of the present invention, a new version may be createdfor every write operation performed on the data structure, or for everynew transaction performed on the data structure, or for one or moretransactions performed between two checkpoints.

In one embodiment, the transaction identifiers (121, 123, . . . , 129)are different from each other so that a time sequence of the versionscan be determined from the set of transaction identifiers. For example,the transaction identifiers can be identification numbers that increasein time. Thus, a version with a smaller transaction identificationnumber is older than a version with a larger transaction identificationnumber.

In general, a transaction identifier can be in various different forms,such as an integer number, a string of characters, etc. The transactionidentifier can also be a timestamp. It is understood that adjusting thesystem clock backward may cause errors when a timestamp smaller thanpreviously used timestamps is used as a transaction identifier. In sucha case, alternative compatible transaction identifiers can be used untilthe backward adjusted system clock runs pass the largest timestamppreviously used. For example, a slow “clock” can be started from thepreviously used largest timestamp to generate pseudo-timestamps astransaction identifiers. Pseudo-timestamps can be generated according tothe slow “clock” until the system clock catches the slow “clock”. Thespeed of the slow “clock” relative to the system clock can be selectedto adjust the temporary time period in which the pseudo-timestamps areused.

In one embodiment of the present invention, different transactionsbetween two checkpoints use different transaction identifiers;alternatively, the transactions between two checkpoints can share onesame transaction identifier.

In one embodiment of the present invention, different data structurescan have different numbers of versions or the same number of versions.Typically, the number of versions maintained for a data structure isdetermined at the time the data structure is created and the storage isallocated. Thus, different versions of the data structure are close toeach other in the non-volatile memory, such as a disk drive, to preventfragmentation.

Alternatively, storage for different versions can be allocateddynamically when the new version is created. For example, a linkedstructure can be used to dynamically add or remove a new version.However, dynamic allocation may cause storage fragmentation.

In the non-volatile memory (101), inconsistency may present in a numberof ways. For example, a transaction on a data structure may involveupdating the data structure multiple times to modify different portionsof the data structure. A partially completed transaction on the datastructure may leave the data structure in an inconsistent state. Forexample, a partially completed write operation may partially modify thedata structure to cause inconsistency.

Further, a transaction may involve updating multiple data structures. Apartial transaction that completely updates some of the data structuresbut not all of the data structures may leave the multiple datastructures in an inconsistent state.

In one embodiment of the present invention, a checkpoint is markedthrough an atomic update to the global transaction identifier (103).When the data on the non-volatile memory reaches a consistent point(e.g., after completing one or more transactions and flushing cacheddata into the non-volatile memory), global transaction identifier (103)is atomically updated to indicate a consistent set of versions of thedata by writing (storing) the new global transaction identifier and thenflushing the non-volatile storage device's cache to ensure that the newglobal transaction identifier has been stored.

For example, a global transaction identifier (103) can be updated to atransaction identification number that is greater than the transactionidentification numbers of completed transactions so that the set ofversions of the data structures on the non-volatile memory (101) thatare closest to but no greater than the global transaction identifier isthe consistent set of versions indicated by the global transactionidentifier (103).

In one embodiment of the present invention, when new versions of datastructures are created, at least one consistent set of versionsindicated by the global transaction identifier (103) is unchanged on thenon-volatile memory (101). When a new consistent set of versions is onthe non-volatile memory (101), the global transaction identifier (103)is updated atomically to switch to the new consistent set.

In one embodiment of the present invention, the global transactionidentifier also has a number of different versions. Thus, a set ofprevious consistent points can be accessed according to previousversions of the global transaction identifier.

In one embodiment of the present invention, different data structures onthe non-volatile memory (101) are on a same physical device (e.g., ahard drive, a flash memory, etc.). Alternatively, different datastructures on the non-volatile memory (101) can be on a different set ofphysical devices (e.g., a set of hard drives, a set of networked storagedevices, NVRAM such as battery powered RAM, a combination of these,etc.).

In one embodiment of the present invention, during normal operation,inconsistent versions (e.g., having a transaction identification numberlarger than the transaction identification number on the non-volatilememory but smaller than any active transaction identification numbers)can also be accessed for read and write (e.g., to completetransactions). After a crash, the inconsistent versions become invalidversions, which are discarded at a proper time based on the recoveryprocess.

FIG. 2 illustrates a scheme to store different versions of data. In FIG.2, a data structure on a non-volatile memory (131) is segmented into anumber of portions. A portion of the data structure can have multipleversions (e.g., 141-144 or 151-154) tagged with different transactionidentifiers (e.g., 145-148 or 155-158) respectively. Thus, differentversions of a portion of the data structure are close to each other onthe non-volatile memory (131). It will be understood that the portionsof the data structure may, in at least certain embodiments, be portionof a file such as an inode file or other files of a file system for adata processing device (e.g., files containing file system metadata).

In FIG. 2, modifications to different portions of the data structure canadvance the versions of different portions differently. Differentportions of the data structure may not synchronously progress into newversions at a consistent point. The position of the new version of oneportion of the data structure may not be used to determine the positionof the new version of another portion at a consistent point, sincedifferent portions are independently modified.

For example, at a first consistent point marked according to globaltransaction identifier (133), a set of consistent versions of portionsof the data structure includes the versions at the first slot (e.g.,versions 141 and 151). Between the first consistent point and a secondconsistent point, data portion X is modified to generate the new version(152) without changing the old version (151); and data portion A is notmodified. Thus, at the second consistent point, a set of consistentversions includes versions at different slots (e.g., versions 141 and152). The portion of the data structure that is modified is copied tocreate the new version. The unmodified portion of the data structure isnot copied. Thus, segmenting a large data structure into portions withindividual version control can reduce the amount of data to be copied tocreate a new version and improve efficiency. On the other side, groupingsmall data structures together can reduce the space used to individuallytag the different versions with transaction identifiers.

FIG. 3 illustrates a file system according to one embodiment of thepresent invention. In FIG. 3, the file system is on a non-volatilememory (e.g., hard drive) (201). The metadata has localized multipleversions. For example, in FIG. 3, the metadata (205) may include aninode for a file, which has user data blocks (e.g., 221, 223, 231, 233).

For example, at one consistent point, the global transaction identifier(203) may indicate that the data version (211) is the latest validversion, which points to user data blocks (221 and 223) for the file.When the filed is updated, new blocks (231 and 233) are used to create anew version (213) of the file. Blocks (221 and 223) may or may not bechanged (e.g., blocks 221 and 223 may be erased or marked for deletionor left unchanged) and the previous version of the file system metadata(211) is not changed. Thus, a previous version of the file is maintainedduring the modification of the file create a new version.

In one embodiment, the user blocks are also tagged with transaction IDs(e.g., 225, 227, 235, 237).

In one embodiment, different versions of the file system metadata filesmay point to the same user data block if the block is not modified. Forexample, in FIG. 4, the user data block (221) is not modified. Thus, themetadata versions (211 and 213) point to the same block. Such anapproach reduces the amount of data to be copied to make a new versionof a file and reduces the amount of storage space used for maintainingmultiple versions of user data.

In one embodiment of the present invention, at least one consistent userdata is stored in the file system. Older versions of the user data canbe eliminated automatically in a background process when the newversions of the user data are secured on the non-volatile memory.

In one embodiment of the present invention, files in the file system areindividually versioned. Different files can have different policies formaintaining different numbers of versions and for different periods oftime.

FIG. 5 illustrates an example of crash recovery according to oneembodiment of the present invention. In one embodiment of the presentinvention, a pessimistic view of the possibility of crashing leads to anapproach of identifying invalid versions actively. A modification list(305) is used to indicate the list of data structures to be modified. Itis not necessary to keep details about the modifications. The list ofdata structures to be modified allows a recovery process to quicklycheck the list of data structures for invalid versions, instead ofsearching the entire non-volatile memory (301) for invalid versions.Since the search for the invalid versions are limited to the list ofdata structures maintained on the modification list (305), the recoveryprocess can be completed quickly.

For example, before a modification is made to the data structure (307),a reference to the data structure (307) is atomically added to themodification list (305) (by writing the list to the storage medium andthen causing the storage medium to flush its caches/buffers). Theflushing of these caches/buffers assures the system that themodification list has been stored on the storage medium (or not store inits entirety, in which case the process can be repeated with the writingof the modification list and the flushing of the modification list).When the modification list (305) is secured on the non-volatile memory(301), modifications to data structure (307) can be atomically made tocomplete a write transaction.

If a crash occurs before the next checkpoint, the recovery process canread the modification list (305) to search in the list of datastructures for invalid versions. For example, since a reference to thedata structure (307) is on the list, the transaction identifiers (e.g.,321, 323, . . . , 325) of the corresponding versions (311, 313, . . . ,315) of the data structure are compared to the global transactionidentifier (303). Any version that is later than the check point markedby the global transaction identifier (303) is an inconsistent versionand can be invalidated. For example, the inconsistent version can betagged with a specially designated transaction ID or other numbers toindicate that the corresponding version is invalid or the version can beerased.

Once the transactions are completed and the data are secured on thenon-volatile memory (301), an atomic update of the global transactionidentifier (303) can be performed to mark the next checkpoint. After theglobal transaction identifier (303) is updated, the old modificationlist can be cleared and replaced with a new modification list.

In FIG. 5, the data structures that may have invalid versions are listedin the modification list (305). Thus, searching the modification list(305) for invalid versions is sufficient to eliminate invalid versionsfrom the non-volatile memory (301).

FIG. 6 shows a method to update data structures for crash recoveryaccording to one embodiment of the present invention. After operation401 writes first data to specify a list of objects to be modified (e.g.,modification list 305), operation 403 flushes the first data in anycache into the non-volatile storage (e.g., flush memory cache and disktrack cache). This flushing operation will make the writing operation401 an atomic operation because the flushing ensures that operation 401either completely happens or doesn't completely happen. In other words,the flushing operation (which is often accomplished with an additionalcommand (e.g., “sync” command) after the write command to the harddrive) ensures that the write is either completely successful or notcompletely successful because the hard drive is forced to actuallyperform the writing of any data in the buffer which is being flushed.Thus, if a crash occurs, the first data can be used to restrict thesearch area for invalid versions to the list of objects to be modified.After operation 405 writes second data tagged according to transactionidentifiers to generate modified versions of the objects in the listwithout destroying a previous version of the list of objects, operation407 flushes the second data to the non-volatile storage. When themodified versions are flushed to the non-volatile storage, a consistentpoint is reached. Operation 409 writes third data to indicate the latestcommitted transaction (e.g., a global transaction ID that is larger thanpreviously used transaction IDs). After operation 409, operation 411flushes the third data to the non-volatile storage. When the third datais secured on a non-volatile storage device, the transaction iscompleted. If a crash occurs before the completion of operation 411, arecovery process can be used to remove the invalid versions. Operations401-411 are typically repeated to process transactions in a way thatsupports quick crash recovery.

FIG. 7 shows a method to recover from a crash according to oneembodiment of the present invention. After a crash, operation 421 readsdata indicating the latest committed transaction (e.g., a globaltransaction ID that was previously atomically recorded). Operation 423reads data specifying a list of objects to be modified. Operation 425checks the list of objects to discard versions generated after thelatest committed transaction. After invalid versions are discarded ormarked to be discarded in future write operations, normal writeoperations can be performed on the storage device to create new versionsof data. It is understood that read operations can be performed beforeoperation 245 is complete. When a data structure is accessed for a readoperation, a version written no later than to the latest committedtransaction is used.

FIG. 8 illustrates another example of crash recovery according to oneembodiment of the present invention. In one embodiment of the presentinvention, an optimistic view of the possibility of crashing leads to anapproach of deferred cleaning of invalid versions. A bad transactionidentifier list (335) is used to maintain a list of invalid transactionidentifiers.

For example, transaction IDs issued for typical write transactions arevalid transaction IDs. When a data structure is accessed, thetransaction IDs for the different versions of the data structure arechecked against the bad transaction identifier list to determine if thecorresponding versions are valid. Typically, the latest valid version isused. If an invalid version is found, the space for the invalid versioncan be reused in a subsequent write operation to create a new version. Aspecially designated transaction ID (or the largest possible transactionID) can be used to tag the invalid version.

If a crash occurs between two checkpoints, the new versions createdbetween the two checkpoints are invalid. A recovery process candetermine a range of transaction IDs that are invalid. Typically, asystem allows a predetermined maximum number of transactions between twocheckpoints. Thus, from the global transaction identifier (303), themaximum possible range of invalid transaction IDs can be determined. Itis understood that the range of invalid transaction IDs does not have tobe exact. It is sufficient that the determined range of invalidtransaction IDs includes the actual invalid transaction IDs. Once therange of bad transaction IDs are secured in to the bad transactionidentifier list (375), the global transaction identifier (303) can beupdated (to have a value which is larger than the largest number in therange of invalid transaction IDs) to mark a new consistent point afterthe crash. New transactions can be then be performed. Since no search toeliminate the invalid versions is necessary to bring the system back tonormal operations, the recovery process can be very quick.

If another crash occurs, the recovery process can further addinformation regarding bad transaction IDs to the bad transaction list(375).

In one embodiment, the bad transaction identifier list includesinformation specifying ranges of bad transaction IDs, such as a startingtransaction ID with an increment, or the beginning and the end of arange of transaction IDs.

When a data structure (e.g., 307) is accessed, the transactionidentifiers (e.g., 321, 323, . . . , 325) of the corresponding versions(311, 313, . . . , 315) of the data structure are compared to the badtransaction list (375) to determine the latest valid version. If aversion of the data structure is invalid, the invalid version may beignored or recycled or retagged. Thus, it is not necessary to scan andremove bad versions before resume normal use of the system.

In one embodiment of the present invention, a background process can beused to scan the bad versions. When the non-volatile memory (301) isfree of bad versions, the bad transaction list can be modifiedaccordingly.

FIG. 9 shows another method to update data structures for crash recoveryaccording to one embodiment of the present invention. The system obtainsthe next (new) transaction ID for a write transaction, which next (new)transaction ID will be used to tag the data which is to be written.Operation 441 writes first data tagged according to transactionidentifiers to generate modified versions of the list of objects withoutdestroying a previous version of the list of objects. Operation 443flushes the first data to non-volatile storage. After operation 445writes second data to indicate the latest committed transaction (e.g., aglobal transaction ID that is no smaller than previously usedtransaction IDs), operation 447 flushes the second data to non-volatilestorage. Operations 441-447 are typically repeated to processtransactions in a way that supports quick crash recovery.

FIG. 10 shows another method to recover from a crash according to oneembodiment of the present invention. After a crash, operation 561 readsdata indicating the latest committed transaction (e.g., a globaltransaction ID that is no smaller than previously used transaction IDs).Operation 563 determines a set of identifier information for invalidtransactions (e.g., increment the latest committed transaction ID by apredetermined number, which is no smaller than an increment oftransaction ID between flushing transactions for non-volatile storage).Operation 565 stores the set of identifier information (e.g., a range ofinvalid transaction IDs) for invalid transactions. Since invalidversions according to the set of identifier information for invalidtransactions are not used and can be overwritten when a new version iscreated, the data system can be returned to normal usage after thecompletion of operation 565. Optionally, operation 567 may search anddiscard invalid versions identified by the set of identifier informationfor invalid transactions (e.g., in a background process, in a scheduledmaintenance process, etc.). Operation 569 optionally modifies the set ofidentifier information when invalid transactions are eliminated.

FIG. 11 shows a method to perform transactions according to oneembodiment of the present invention. Operation 581 atomically records afirst global transaction identifier to indicate a first consistent pointfor a plurality of first versions of a plurality of data structures(e.g., metadata of a file system). Operation 583 creates (e.g., byatomic recording operations) a plurality of second versions of anarbitrary portion of the plurality of data structures without destroyingthe plurality of first versions of the plurality of data structures.Operation 585 atomically records a second global transaction identifierto indicate a second consistent point for the plurality of secondversions of the portion of the plurality of data structures and aportion of the plurality of first versions of the plurality of datastructures.

FIG. 12 shows a system to perform transactions according to oneembodiment of the present invention. In FIG. 12, a processor (615) maymanage the data on the disk drive (605) using an I/O buffer/cache (603)in host memory (601). The disk drive (605) has a volatile track cache(607) to increase performance. For example, the disk drive (605) maycache the write requests in the track cache (607) for batch updates tothe non-volatile disk track (609). Using the track cache (607), the diskdrive (605) may write data out of order to optimize performance.

A track cache of a disk drive is typically volatile. When a crashoccurs, the data in the track cache is typically lost. After the bufferand cache (e.g., 603 and 607) are flushed, the data is finally recordedin the non-volatile disk track, which is typically accessible after asystem crash, although a media failure may cause the loss of the datastored in the non-volatile disk track. Data redundancy is a typicallyapproach used to protect data against media failures.

Note that FIG. 12 illustrates a system compatible with a typical diskdrive available today. However, there are alternatives to the systemdepicted in FIG. 12, since the disk drive may use different means toguarantee the recording of the data onto permanent storage. For example,some disk drives may support a force-unit-access option when writingdata to force recording the data to permanent storage. Thus, in general,the software according to one embodiment of the present invention maysend additional and/or special commands to the disk drive to force thedisk drive to write the data into the permanent storage.

In one embodiment of the present invention, the global transactionidentifier is atomically updated on the non-volatile disk track (609) tomark a consistent point and indicate a set of consistent versions ofdata structures. An atomic update of the global transaction identifieris performed after data for pending transactions are flushed into thenon-volatile disk track (609) and before any further modifications aremade.

In one embodiment, a data structure (e.g., 613) maintains multipleversions that are tagged with different transaction IDs. A set ofconsistent versions is unchanged on the non-volatile disk track whilemodifications are made to create new versions. Thus, at least oneconsistent version of data is available on the non-volatile disk trackif a crash occurs.

Thus, the system of FIG. 12 periodically flushes buffers and caches tomake a set of consistent data versions and then atomically records theglobal transaction identifier (611) to mark the new consistent point.

In one embodiment, different versions of a data structure (e.g., 613)are located close to each other on the non-volatile disk track (609) toprevent fragmentation and improve access performance.

FIG. 13 shows one example of a typical computer system which may be usedwith the present invention. Note that while FIG. 13 illustrates variouscomponents of a computer system, it is not intended to represent anyparticular architecture or manner of interconnecting the components assuch details are not germane to the present invention. It will also beappreciated that network computers and other data processing systemswhich have fewer or more components may also be used with the presentinvention. The computer system of FIG. 13 may, for example, be an AppleMacintosh computer.

As shown in FIG. 13, the computer system 701, which is a form of a dataprocessing system, includes a bus 702 and system core logic 712 whichinterconnect a microprocessor 703, a ROM 707, and volatile RAM 705 and anon-volatile memory 706. The microprocessor 703, which may be, forexample, a G3 or G4 or G5 microprocessor from Motorola, Inc. or IBM iscoupled to cache memory 704 as shown in the example of FIG. 13. The bus702 and system core logic 712 interconnect these various componentstogether and also interconnects these components 703, 707, 705, and 706to a display controller and display device 708 and to peripheral devicessuch as input/output (I/O) devices which may be mice, keyboards, modems,network interfaces, printers, scanners, video cameras and other deviceswhich are well known in the art. Typically, the input/output devices 710are coupled to the system through input/output controllers 709. Thevolatile RAM 705 is typically implemented as dynamic RAM (DRAM) whichrequires power continually in order to refresh or maintain the data inthe memory. The non-volatile memory 706 is typically a magnetic harddrive, a magnetic optical drive, or an optical drive (e.g., a DVD RAM),or other type of memory system which maintains data even after power isremoved from the system. Typically, the non-volatile memory will also bea random access memory although this is not required. While FIG. 13shows that the non-volatile memory is a local device coupled directly tothe rest of the components in the data processing system, it will beappreciated that the present invention may utilize a non-volatile memorywhich is remote from the system, such as a network storage device thatis coupled to the data processing system through a network interfacesuch as a modem or Ethernet interface. The bus 702 may include one ormore buses connected to one another through various bridges, controllersand/or adapters as is well known in the art. In one embodiment the I/Ocontroller 709 includes a USB (Universal Serial Bus) adapter forcontrolling USB peripherals, and/or an IEEE-1394 bus adapter forcontrolling IEEE-1394 peripherals.

It will be apparent from this description that aspects of the presentinvention may be embodied, at least in part, in software. That is, thetechniques may be carried out in a computer system or other dataprocessing system in response to its processor, such as amicroprocessor, executing sequences of instructions contained in amemory, such as ROM 707, volatile RAM 705, non-volatile memory 706,cache 704 or a remote storage device. In various embodiments, hardwiredcircuitry may be used in combination with software instructions toimplement the present invention. Thus, the techniques are not limited toany specific combination of hardware circuitry and software nor to anyparticular source for the instructions executed by the data processingsystem. In addition, throughout this description, various functions andoperations are described as being performed by or caused by softwarecode to simplify description. However, those skilled in the art willrecognize what is meant by such expressions is that the functions resultfrom execution of the code by a processor, such as the microprocessor703.

A machine readable medium can be used to store software and data whichwhen executed by a data processing system causes the system to performvarious methods of the present invention. This executable software anddata may be stored in various places including for example ROM 707,volatile RAM 705, non-volatile memory 706 and/or cache 704 as shown inFIG. 13. Portions of this software and/or data may be stored in any oneof these storage devices.

Thus, a machine readable medium includes any mechanism that provides(i.e., stores and/or transmits) information in a form accessible by amachine (e.g., a computer, network device, personal digital assistant,manufacturing tool, any device with a set of one or more processors,etc.). For example, a machine readable medium includes machine readablestorage medium such as recordable/non-recordable media (e.g., read onlymemory (ROM), random access memory (RAM), magnetic disk storage media,optical storage media, flash memory devices, etc.), as well as machinereadable transmission medium such as electrical, optical, acoustical orother forms of propagated signals (e.g., carrier waves, infraredsignals, digital signals, etc.), etc.

In the foregoing specification, the invention has been described withreference to specific exemplary embodiments thereof. It will be evidentthat various modifications may be made thereto without departing fromthe broader spirit and scope of the invention as set forth in thefollowing claims. The specification and drawings are, accordingly, to beregarded in an illustrative sense rather than a restrictive sense.

1. A machine readable storage medium containing executable computerprogram instructions which when executed by a data processing systemcause said system to perform a method, comprising: atomically recordinga first global transaction identifier to indicate a first consistentpoint, the first consistent point comprising a plurality of firstversions of a plurality of data structures, wherein each of theplurality of first versions is tagged with a different one of a firstset of a plurality of transaction identifiers, wherein each of the firstset of transaction identifiers indicate that the plurality of firstversions are created no later than the first global transactionidentifier; creating one or more second versions of a portion of theplurality of data structures without destroying the plurality of firstversions of the plurality of data structures, wherein each of the one ormore second versions is tagged with a different one of a second set ofone or more transaction identifiers, wherein each of the second set oftransaction identifiers indicate that the one or more second versionsare created no earlier than the first global transaction identifier; andatomically recording a second global transaction identifier to indicatea second consistent point, the second consistent point comprising theone or more second versions of the portion of the plurality of datastructures and a portion of the plurality of first versions of theplurality of data structures, wherein each of the second set of one ormore transaction identifiers further indicate that the one or moresecond versions are created no later than the second global transactionidentifier; recording information identifying the portion of theplurality of data structures before creating the one or more secondversions; and searching the portion of the plurality of data structuresaccording to the information for invalid versions after a crash.
 2. Themedium of claim 1, wherein the portion of the plurality of firstversions of the plurality of data structures is a null set.
 3. Themedium of claim 1, wherein the data structures comprise metadata of afile system for at least one machine readable storage device; andwherein a portion of the data structure corresponding to the portion ofthe plurality of first versions is not changed between the first andsecond consistent points.
 4. The medium of claim 1, wherein the methodfurther comprises: determining one or more third transaction identifiersafter the crash, the one or more third transaction identifiers includingthe one or more second transaction identifiers; and recordinginformation specifying the one or more third transaction identifiers toindicate that versions tagged with the one or more third transactionidentifiers are invalid.
 5. The medium of claim 4, wherein the methodfurther comprises: searching in a background process for an invalidversion that is tagged with one of the one or more third transactionidentifiers.
 6. A method for data protection, the method comprising:atomically recording a first global transaction identifier to indicate afirst consistent point for a plurality of first versions of a pluralityof data structures, wherein each of the plurality of first versions istagged with a different one of a first set of a plurality of transactionidentifiers, wherein each of the first set of transaction identifiersindicate that the plurality of first versions are created no later thanthe first global transaction identifier; creating one or more secondversions of a portion of the plurality of data structures withoutdestroying the plurality of first versions of the plurality of datastructures, wherein each of the one or more second versions is taggedwith a different one of a second set of one or more transactionidentifiers, wherein each of the second set of transaction identifiersindicate that each of the one or more second versions are created noearlier than the first global transaction identifier; and atomicallyrecording a second global transaction identifier to indicate a secondconsistent point for the one or more second versions of the portion ofthe plurality of data structures and a portion of the plurality of firstversions of the plurality of data structures, wherein each of the secondset of one or more transaction identifiers further indicate that each ofthe one or more second versions are created no later than the secondglobal transaction identifier; recording information identifying theportion of the plurality of data structures before creating the one ormore second versions; and searching the portion of the plurality of datastructures according to the information for invalid versions after acrash.
 7. The method of claim 6, wherein the data structures comprisemetadata of a file system.
 8. The method of claim 7, further comprising:determining one or more third transaction identifiers after a crash, theone or more third transaction identifiers including the one or moresecond transaction identifiers; recording information specifying the oneor more third transaction identifiers to indicate that versions taggedwith the one or more third transaction identifiers are invalid; andsearching in a background process for an invalid version that is taggedwith one of the one or more third transaction identifiers.
 9. A machinereadable storage-medium containing executable computer programinstructions which when executed by a data processing system cause saidsystem to perform a method for processing data, the method comprising:maintaining a first version of portions of a file and a correspondingfirst transaction ID; storing a second version of portions of the fileand a corresponding second transaction ID, said second version beingidentifiable as a later version with respect to said first versionthrough comparison of said first and second transaction IDs; andstoring, through an atomic recording process, a global transaction ID tomark a consistent point in relation with the first and secondtransaction IDs, wherein said first version or said second version isdetermined to be part of said consistent point through comparison ofsaid first and second transaction IDs and said global transaction ID,wherein said second version is part of the consistent point if saidsecond transaction ID is less than the global transaction ID and saidfirst version is part of the consistent point if said second transactionID is greater than the global transaction ID; wherein a later recordedversion has a transaction ID higher than a corresponding earlierrecorded version, and, a version with a transaction ID closest to, butnot larger than, the global transaction ID is a part of the consistentpoint.
 10. The medium of claim 9, wherein the global transaction IDmarks the consistent point for a plurality of files based on a relationbetween the global transaction ID and transaction IDs of versions ofportions of the plurality of files.
 11. The medium of claim 9, whereinthe file, the first and second transaction ID and the global transactionID are stored in one non-volatile storage device.
 12. A method forprocessing data, the method comprising: maintaining a first version ofportions of a file and a corresponding first transaction ID; storing asecond version of portions of the file and a corresponding secondtransaction ID, said second version being identifiable as a laterversion with respect to said first version through comparison of saidfirst and second transaction IDs; and storing, through an atomicrecording process, a global transaction ID to mark a consistent point inrelation with the first and second transaction IDs, wherein said firstversion or said second version is determined to be part of saidconsistent point through comparison of said first and second transactionIDs and said global transaction ID, wherein said second version is partof the consistent point if said second transaction ID is less than theglobal transaction ID and said first version is part of the consistentpoint if said second transaction ID is greater than the globaltransaction ID; wherein a later recorded version has a transaction IDhigher than a corresponding earlier recorded version, and, a versionwith a transaction ID closest to, but not larger than, the globaltransaction ID is a part of the consistent point.
 13. The method ofclaim 12, wherein the global transaction ID marks the consistent pointfor a plurality of files based on a relation between the globaltransaction ID and transaction IDs of versions of portions of theplurality of files; and wherein the file, the first and secondtransaction ID and the global transaction ID are stored in onenon-volatile storage device.
 14. A machine readable storage mediumcontaining executable computer program instructions which when executedby a data processing system cause said system to perform a method,comprising: atomically recording a first global transaction identifierto indicate a first consistent point, the first consistent pointcomprising a plurality of first versions of a plurality of datastructures, wherein each of the plurality of first versions is taggedwith a different one of a first set of a plurality of transactionidentifiers, wherein each of the first set of transaction identifiersindicate that the plurality of first versions are created no later thanthe first global transaction identifier; creating one or more secondversions of a portion of the plurality of data structures withoutdestroying the plurality of first versions of the plurality of datastructures, wherein each of the one or more second versions is taggedwith a different one of a second set of one or more transactionidentifiers, wherein each of the second set of transaction identifiersindicate that the one or more second versions are created no earlierthan the first global transaction identifier; and atomically recording asecond global transaction identifier to indicate a second consistentpoint, the second consistent point comprising the one or more secondversions of the portion of the plurality of data structures and aportion of the plurality of first versions of the plurality of datastructures, wherein each of the second set of one or more transactionidentifiers further indicate that the one or more second versions arecreated no later than the second global transaction identifier;determining one or more third transaction identifiers after a crash, theone or more third transaction identifiers including the one or moresecond transaction identifiers; and, recording information specifyingthe one or more third transaction identifiers to indicate that versionstagged with the one or more third transaction identifiers are invalid.15. The medium of claim 14, wherein the method further comprises:searching in a background process for an invalid version that is taggedwith one of the one or more third transaction identifiers.
 16. A methodfor data protection, the method comprising: atomically recording a firstglobal transaction identifier to indicate a first consistent point for aplurality of first versions of a plurality of data structures, whereineach of the plurality of first versions is tagged with a different oneof a first set of a plurality of transaction identifiers, wherein eachof the first set of transaction identifiers indicate that the pluralityof first versions are created no later than the first global transactionidentifier; creating one or more second versions of a portion of theplurality of data structures without destroying the plurality of firstversions of the plurality of data structures, wherein each of the one ormore second versions is tagged with a different one of a second set ofone or more transaction identifiers, wherein each of the second set oftransaction identifiers indicate that each of the one or more secondversions are created no earlier than the first global transactionidentifier; and atomically recording a second global transactionidentifier to indicate a second consistent point for the one or moresecond versions of the portion of the plurality of data structures and aportion of the plurality of first versions of the plurality of datastructures, wherein each of the second set of one or more transactionidentifiers further indicate that each of the one or more secondversions are created no later than the second global transactionidentifier; determining one or more third transaction identifiers aftera crash, the one or more third transaction identifiers including the oneor more second transaction identifiers; recording information specifyingthe one or more third transaction identifiers to indicate that versionstagged with the one or more third transaction identifiers are invalid;and searching in a background process for an invalid version that istagged with one of the one or more third transaction identifiers. 17.The method of claim 16, wherein the data structures comprise metadata ofa file system.
 18. A machine readable storage medium containingexecutable computer program instructions which when executed by a dataprocessing system cause said system to perform a method for processingdata, the method comprising: maintaining a first version of portions ofa file and a corresponding first transaction ID; storing a secondversion of portions of the file and a corresponding second transactionID, said second version being identifiable as a later version withrespect to said first version through comparison of said first andsecond transaction IDs; and storing, through an atomic recordingprocess, a global transaction ID to mark a consistent point in relationwith the first and second transaction IDs, wherein said first version orsaid second version is determined to be part of said consistent pointthrough comparison of said first and second transaction IDs and saidglobal transaction ID, wherein said second version is part of theconsistent point if said second transaction ID is less than the globaltransaction ID and said first version is part of the consistent point ifsaid second transaction ID is greater than the global transaction ID;wherein the global transaction ID marks the consistent point for aplurality of files based on a relation between the global transaction IDand transaction IDs of versions of portions of the plurality of files.19. The medium of claim 18, wherein the file, the first and secondtransaction ID and the global transaction ID are stored in onenon-volatile storage device.
 20. A method for processing data, themethod comprising: maintaining a first version of portions of a file anda corresponding first transaction ID; storing a second version ofportions of the file and a corresponding second transaction ID, saidsecond version being identifiable as a later version with respect tosaid first version through comparison of said first and secondtransaction IDs; and storing, through an atomic recording process, aglobal transaction ID to mark a consistent point in relation with thefirst and second transaction IDs, wherein said first version or saidsecond version is determined to be part of said consistent point throughcomparison of said first and second transaction IDs and said globaltransaction ID, wherein said second version is part of the consistentpoint if said second transaction ID is less than the global transactionID and said first version is part of the consistent point if said secondtransaction ID is greater than the global transaction ID; wherein theglobal transaction ID marks the consistent point for a plurality offiles based on a relation between the global transaction ID andtransaction IDs of versions of portions of the plurality of files; andwherein the file, the first and second transaction ID and the globaltransaction ID are stored in one non-volatile storage device.
 21. Themedium of claim 20, wherein the file, the first and second transactionID and the global transaction ID are stored in one non-volatile storagedevice.
 22. A method for processing data, the method comprising:maintaining a first version of portions of a file and a correspondingfirst transaction ID; storing a second version of portions of the fileand a corresponding second transaction ID, said second version beingidentifiable as a later version with respect to said first versionthrough comparison of said first and second transaction IDs; andstoring, through an atomic recording process, a global transaction ID tomark a consistent point in relation with the first and secondtransaction IDs, wherein said first version or said second version isdetermined to be part of said consistent point through comparison ofsaid first and second transaction IDs and said global transaction ID,wherein said second version is part of the consistent point if saidsecond transaction ID is less than the global transaction ID and saidfirst version is part of the consistent point if said second transactionID is greater than the global transaction ID; wherein the globaltransaction ID marks the consistent point for a plurality of files basedon a relation between the global transaction ID and transaction IDs ofversions of portions of the plurality of files; and wherein the file,the first and second transaction ID and the global transaction ID arestored in one non-volatile storage device.